Carbon Black Console: Live Response intermittently fails in various ways.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Intermittent problems may include, failure to connect, large file transfer only partially succeeding, general instability.
• Confer.log will show a block of messages like this:

• 09/21/22 13:31:40.876: 18d8 ERROR CMessageObj::ParseReplyHeader: errorCode = 105 (0x00000069), success = false
  09/21/22 13:31:40.876: 18d8 ERROR CMessageObj::ParseReplyHeader: Server returned error (105 0x00000069):
  09/21/22 13:31:40.876: 18d8 ERROR CBLR: Failed to post reply for quit msg! siStatus[25] backendErr[105]

Environment

• CBC Sensor: All versions
• CBC Server:  All versions

Cause

ErrorCode = 105 means unable to resolve a server's DNS address failed.

Resolution

There is likely a DNS network configuration or device that is not handling the DNS resolution request. If the problem is intermittent, have the site network team troubleshoot configurations where there are interchangeable parts, such as two DNS servers from different providers, or a round robin DNS configuration.
 

Additional Information